Advanced NetFlow Traffic Analysis - network monitoring Archivestag:blog.tmcnet.com,2012-01-03:/advanced-netflow-traffic-analysis//1642012-05-01T23:47:13ZMonitoring BYOD traffic with NetFlowtag:blog.tmcnet.com,2012:/advanced-netflow-traffic-analysis//164.490752012-03-24T09:48:50Z2012-05-01T23:47:13ZMichael Pattersonhttp://blog.tmcnet.com/advanced-netflow-traffic-analysis/
Monitoring BYOD traffic is a growing concern amonst network administrators. Why? Gartner predicts that 645 million smartphones will be sold in 2012 – a 40% increase from this year. Cell phone reception is often weak on the interior of office buildings and smartphone owners will have their WiFi on. What's more is that many companies are allowing employees onto the corporate net with their personal smart phones in hopes of increased productivity.

Employees using Corporate Bandwidth with Personal PhonesThis big increase brings with it big concerns when it comes to network monitoring:

How much bandwidth are all these additional devices collectively using and is it impacting business critical applications?

What applications and web sites are users hitting and what impact are these distractions having on productivity and how often?

What are the security implications introduced by allowing these devices onto the net? Many of these hand held devices do not have antivirus software.

Given that the traffic from a cell phone browsing a web site looks nearly identical to that of a PC hitting the same site, how can a company determine the amount of Internet bandwidth utilized by the combined smart phone devices? To answer this, we need a new flow element.

All hardware accessing the LAN utilizes a six byte hexadecimal MAC address. The first three bytes of this address is reserved to identify the vendor. For example, an iPhone may have an address of E4:CE:8F:C2:9D:AA. The first three bytes E4:CE:8F identifies the vendor ‘Apple’ and it is likely that thousands of other iPhones start with the same 3 bytes. The remaining three bytes C2:9D:AA are unique to the individual iPhone.

Nearly a dozen vendors (e.g. Cisco, Enterasys, Exinda, Juniper, nBox, Sonicwall) are now exporting MAC information in their flow exports. Learn how to export [MAC address with Flexible NetFlow] http://www.plixer.com/blog/netflow/getting-mac-addresses-from-netflow-v9/ . Setting up a simple network monitor will help you proactively keep track of this traffic.

If your NetFlow or IPFIX hardware can export Username, you could click on a username and see the number of devices authenticated by the same user.

Monitoring BYOD traffic is a growing concern and the above report can be run against flow exports from the Cisco ASA, Palo Alto Networks and the SonicWALL (example above). Vendors are always looking for new and innovative ways to filter on this data.

[Gartner predicts that 645 million smartphones] http://www.channelinsider.com/c/a/Mobile-Devices/Mobile-Management-Styles-Driven-by-Consumerization-Gartner-634465/ will be sold in 2012 – a 40% increase from this year. Cell phone reception is often weak on the interior of office buildings and smartphone owners will have their WiFi on. Many companies are allowing employees onto the corporate net with their personal smart phones in hopes of increased productivity.

Employees using Corporate Bandwidth with Personal PhonesThis big increase brings with it big concerns when it comes to network monitoring: 1. How much bandwidth are all these additional devices collectively using and is it impacting business critical applications?2. What applications and web sites are users hitting and what impact are these distractions having on productivity and how often?3. What are the security implications introduced by allowing these devices onto the net? Many of these hand held devices do not have antivirus software. Given that the traffic from a cell phone browsing a web site looks nearly identical to that of a PC hitting the same site, how can a company determine the amount of Internet bandwidth utilized by the combined smart phone devices? To answer this, we need a new flow element.

All hardware accessing the LAN utilizes a six byte hexadecimal MAC address. The first three bytes of this address is reserved to identify the vendor. For example, an iPhone may have an address of E4:CE:8F:C2:9D:AA. The first three bytes E4:CE:8F identifies the vendor ‘Apple’ and it is likely that thousands of other iPhones start with the same 3 bytes. The remaining three bytes C2:9D:AA are unique to the individual iPhone.

<<< monitoringMobilePhoneTraffic.png >>>

Nearly a dozen vendors (e.g. Cisco, Enterasys, Exinda, Juniper, nBox, Sonicwall) are now exporting MAC information in their flow exports. Learn how to export [MAC address with Flexible NetFlow] http://www.plixer.com/blog/netflow/getting-mac-addresses-from-netflow-v9/ . Setting up a simple network monitor will help you proactively keep track of this traffic.

If your NetFlow or IPFIX hardware can export Username, you could click on a username and see the number of devices authenticated by the same user.

<<< sonicwall-Ipfix-username.png >>>

Monitoring BYOD traffic is a growing concern and the above report can be run against flow exports from the Cisco ASA, Palo Alto Networks and the SonicWALL (example above). Vendors are always looking for new and innovative ways to filter on this data.

1.How much bandwidth are all these additional devices collectively using and is it impacting business critical applications?

2.What applications and web sites are users hitting and what impact are these distractions having on productivity and how often?

3.What are the security implications introduced by allowing these devices onto the net? Many of these hand held devices do not have antivirus software.

Given that the traffic from a cell phone browsing a web site looks nearly identical to that of a PC hitting the same site, how can a company determine the amount of Internet bandwidth utilized by the combined smart phone devices?To answer this, we need a new flow element.

All hardware accessing the LAN utilizes a six byte hexadecimal MAC address.The first three bytes of this address is reserved to identify the vendor.For example, an iPhone may have an address of E4:CE:8F:C2:9D:AA.The first three bytes E4:CE:8F identifies the vendor ‘Apple’ and it is likely that thousands of other iPhones start with the same 3 bytes.The remaining three bytes C2:9D:AA are unique to the individual iPhone.

If your NetFlow or IPFIX hardware can export Username, you could click on a username and see the number of devices authenticated by the same user.

<<< sonicwall-Ipfix-username.png >>>

Monitoring BYOD traffic is a growing concern and the above report can be run against flow exports from the Cisco ASA, Palo Alto Networks and the SonicWALL (example above).Vendors are always looking for new and innovative ways to filter on this data.

KEY WORDS:

network monitoring

flexible netflow

network monitor

monitoring mobile phone traffic

monitoring byod traffic

]]>
Monitoring Video Performance with NetFlowtag:blog.tmcnet.com,2012:/advanced-netflow-traffic-analysis//164.488312012-02-19T07:41:55Z2012-02-19T08:43:34ZThree years ago I was listening to John Chambers - CEO of Cisco Systems, proclaim that video was going to be the rage. I snickered and though it would be long time before anyone will be monitoring video performance with...Michael Pattersonhttp://blog.tmcnet.com/advanced-netflow-traffic-analysis/

Reporting on Skype with NetFlowDuring a Skype connection with my daughter who was in my wife's car, my daughter wanted to show me her sneakers and then her book:

I noticed a big difference from when we just talked over the telephone. Seeing my face made her realize that I was fully engaged in what she had to say. She then put her jacket and shoes on and took the mobile phone outside to show me the fort she had built using scraps of wood. I couldn't believe it. She moved the camera in close for me to see things. She then brought be inside and put the phone in front of the dog so that I could say hello to 'Charlie'.

I have to admit, I liked the video especially since I was in London, England and my daughter was in Maine. What I didn't like was the jitter. I'm glad there are tools in our NetFlow traffic analyzer called Scrutinizer to monitor this.

Three years later at Cisco Live 2012 in London I was listening to Chief Cisco Futurist David Evans about the future of networking. I learned that video and data in general over the internet will continue to explode. This time I BELIEVE!

Cisco Performance MonitoringPlixer was the first Cisco NetFlow Partner to become certified for Cisco Medianet Performance monitoring reports. Check out the VoIP jitter or lost packets in the network monitoring report below.

The above is VoIP with our Asterisk server. Skype traffic uses both TCP and UDP. We can measure the TCP latency during the connection setup with NetFlow Performance monitoring to look at Skype traffic as well. Today, customers can monitor cloud services with NetFlow. The example report below is filtering for the Cisco NBAR detected application: Skype.

Next Generation NetFlowKeep in mind that these reports require the use of Flexible NetFlow which doesn't use the command ip route-cache flow. Make sure you are running IOS 15.2(2)T or more recent for the most capable Flexible NetFlow exports. The latest version provides even more network latency details than what is displayed above. I'm talking about Cisco IP SLA.

Performance Routing NetFlowCisco Performance Routing (PfR) can export IP SLA details using Flexible NetFlow. When a router determines that a connection is a bit congested, it will evaluate existing flows and reroute traffic over different connections ensuring priority to time sensitive traffic. By using PfR and Cisco Performance Monitoring together with Flow Hopper, administrators gain end to end network visibility on a link by link, hop by hop basis all with NetFlow.

The bottom line: Network traffic monitoring with NetFlow is at a whole new level from just two years ago. Join NetFlow Developments on Linkedin and stay on top of the future of NetFlow.